AMENDMENTS TO THE CLAIMS 



This listing of claims will replace all prior versions, and listings, of claims 
in the application: 

Listing of Claims: 



1 1 . (Currently amended) A method that facilitates secure electronic 

2 commerce, comprising: 

3 providing a consumer with a file of security data relating to an account 

4 maintained by a financial institution, wherein the file of security data is provided 

5 to the consumer on a smart card, and wherein the file of security data includes: 

6 a consumer identifier, 

7 a private key for encryption and authentication of data, 

8 a first public key related to the private key for decryption 

9 and authentication of data, 

10 an identifier identifying the financial institution, 

l\ a second public key belonging to the financial institution, 

1 2 the account number that has been encrypted with a key 

1 3 known only to the financial institution creating an encrypted 

1 4 account number, 

1 5 a first certificate signed by a recognized certificate authority 

1 6 that validates the financial institution, 

1 7 a second certificate signed by the financial institution that 

1 8 validates the consumer, and 

1 9 computer algorithms to use the file of security data; 

20 creating a financial transaction between the consumer and a merchant, 

21 wherein the financial transaction is protected using security data from the file, and 
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22 wherein the financial transaction is structured to contain an account number in a 

23 form that is undecipherable by the merchant, thereby prevent the merchant from 

24 knowing the account number for the account; 

25 validating by the merchant that the financial institution identified by the 

26 financial transaction is acceptable using security data from the file; 

27 wherein validating by the merchant involves: 

28 receiving at the merchant the first certificate; and 

29 validating that the first certificate was signed by the recognized certificate 

30 authority; 

3 1 requesting by the merchant that the financial institution authorize the 

32 financial transaction; 

33 receiving by the merchant an authorization from the financial institution to 

34 complete the financial transaction; 

35 completing the financial transaction between the consumer and the 

36 merchant; and 

37 notifying the financial institution that the financial transaction is complete. 
1 2-3 (Canceled). 

1 4. (Currently amended) The method of claim 1, wherein protecting the 

2 financial transaction involves: 

3 creating a first hash of the financial transaction; and 

4 encrypting the first hash, the second certificate, and the encrypted account 

5 number using the second public key creating a secure envelope of transaction 

6 data, wherein the first hash is created at a secure site available only to the 

7 consumer. 
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1 5. (Original) The method of claim 4, wherein requesting by the merchant 

2 that the financial institution authorize the financial transaction involves: 

3 creating a second hash of the financial transaction by the merchant; 

4 sending the secure envelope and the second hash to the financial 

5 institution; 

6 decrypting at the financial institution the secure envelope using the private 

7 key of the financial institution; 

8 comparing the first hash with the second hash; and 

9 if the first hash is identical to the second hash, 

I o decrypting the encrypted account number to recover the 

I I account number for the account belonging to the consumer, 

1 2 verifying that the financial transaction is valid for the 

13 account, and 

1 4 if valid, authorizing the financial transaction. 

1 6. (Original) The method of claim 5, wherein verifying that the financial 

2 transaction is valid for the account includes: 

3 verifying that the second certificate was signed by the financial institution; 

4 determining that the account is valid; and 

5 ensuring that a transaction amount is not greater than an authorized 

6 transaction amount. 

1 7. (Original) The method of claim 4, wherein the secure site available only 

2 to the consumer is within the smart card. 

1 8. (Cancelled) 
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1 9. (Currently amended) A computer-readable storage medium storing 

2 instructions that when executed by a computer cause the computer to perform a 

3 method that facilitates secure electronic commerce, comprising: 

4 providing a consumer with a file of security data relating to an account 

5 maintained by a financial institution, wherein the file of security data is provided 

6 to the consumer on a smart card , and wherein the file of security data includes: 

7 a consumer identifier, 

g a private key for encryption and authentication of data, 

9 a first public key related to the private key for decryption 

1 0 and authentication of data, 

1 1 an identifier identifying the financial institution, 

12 a second public key belonging to the financial institution, 

1 3 the account number that has been encrypted with a key 

14 known only to the financial institution creating an encrypted 

1 5 account number, 

1 g a first certificate signed by a recognized certificate authority 

1 7 that validates the financial institution, 

1 g a second certificate signed by the financial institution that 

1 9 validates the consumer, 

20 computer algorithms to use the file of security data; 

21 creating a financial transaction between the consumer and a merchant, 

22 wherein the financial transaction is protected using security data from the file, and 

23 wherein the financial transaction is structured to contain an account number in a 

24 form that is undecipherable by the merchant, thereby prevent the merchant from 

25 knowing the account number for the account; 

26 validating by the merchant that the financial institution identified by the 

27 financial transaction is acceptable using security data from the file; 

28 wherein validating by the merchant involves: 
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receiving at the merchant the first certificate: and 

validating that the first certificate was signed bv the recognized certificate 
authority; 

requesting by the merchant that the financial institution authorize the 
financial transaction; 

receiving by the merchant an authorization from the financial institution to 
complete the financial transaction; 

completing the financial transaction between the consumer and the 

merchant; and 

notifying the financial institution that the financial transaction is complete. 
10-11 (Canceled). 

12. (Currently amended) The computer-readable storage medium of claim 
9, wherein protecting the financial transaction involves: 

creating a first hash of the financial transaction; and 

encrypting the first hash, the second certificate, and the encrypted account 
number using the second public key creating a secure envelope of transaction 
data, wherein the first hash is created at a secure site available only to the 
consumer. 

13. (Original) The computer-readable storage medium of claim 12, 
wherein requesting by the merchant that the financial institution authorize the 
financial transaction involves: 

creating a second hash of the financial transaction by the merchant; 
sending the secure envelope and the second hash to the financial 
institution; 
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7 decrypting at the financial institution the secure envelope using the private 

8 key of the financial institution; 

9 comparing the first hash with the second hash; and 

1 0 if the first hash is identical to the second hash, 

1 1 decrypting the encrypted account number to recover the 

1 2 account number for the account belonging to the consumer, 

1 3 verifying that the financial transaction is valid for the 

14 account, and 

1 5 if valid, authorizing the financial transaction. 

1 14. (Original) The computer-readable storage medium of claim 1 3 , 

2 wherein verifying that the financial transaction is valid for the account includes: 

3 verifying that the second certificate was signed by the financial institution; 

4 determining that the account is valid; and 

5 ensuring that a transaction amount is not greater than an authorized 

6 transaction amount. 

1 15. (Original) The computer-readable storage medium of claim 12, 

2 wherein the secure site available only to the consumer is within the smart card. 

1 16. (Cancelled) 

1 17. (Currently amended) An apparatus that facilitates secure electronic 

2 commerce, comprising: 

3 a providing mechanism configured to provide a consumer with a 

4 file of security data relating to an account maintained by a financial 

5 institution, wherein the file of security data is provided to the consumer on 

6 a smart card , and wherein the file of security data includes: 
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7 a consumer identifier, 

8 a private key for encryption and authentication of data, 

9 a first public key related to the private key for decryption 

1 0 and authentication of data, 

1 1 an identifier identifying the financial institution, 

12 a second public key belonging to the financial institution, 

1 3 the account number that has been encrypted with a key 

14 known only to the financial institution creating an encrypted 

1 5 account number, 

1 6 a first certificate signed by a recognized certificate authority 

1 7 that validates the financial institution, 

1 8 a second certificate signed by the financial institution that 

1 9 validates the consumer, and 

20 computer algorithms to use the file of security data; 

21 a first creating mechanism configured to create a financial transaction 

22 between the consumer and a merchant, wherein the financial transaction is 

23 protected using security data from the file, and wherein the financial transaction is 

24 structured to contain an account number in a form that is undecipherable by the 

25 merchant, thereby prevent the merchant from knowing the account number for the 

26 account; 

27 a first validating mechanism that is configured to validate that the financial 

28 institution identified by the financial transaction is acceptable using security data 

29 from the file; 

30 a second receivinfi mechanism at the merchant that is configured to receive 

31 the first certificate; and 

32 a second validating mechanism that is configured to validate that the first 

33 certificate was signed by the recognized certificate authority; 
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34 a requesting mechanism that is configured to request that the financial 

35 institution authorize the financial transaction; 

36 a first receiving mechanism that is configured to receive an authorization 

37 from the financial institution to complete the financial transaction; 

38 a completing mechanism that is configured to complete the financial 

39 transaction between the consumer and the merchant; and 

40 a notifying mechanism that is configured to notify the financial institution 

41 that the financial transaction is complete. 

1 18-19 (Canceled). 

1 20. (Currently amended) The apparatus of claim 17, further comprising: 

2 a second creating mechanism that is configured to create a first hash of the 

3 financial transaction; and 

4 an encrypting mechanism that is configured to encrypt the first hash, the 

5 second certificate, and the encrypted account number using the second public key 

6 creating a secure envelope of transaction data, wherein the first hash is created at a 

7 secure site available only to the consumer. 

1 21 . (Original) The apparatus of claim 20, further comprising: 

2 a creating mechanism that is configured to create a second hash of the 

3 financial transaction by the merchant; 

4 a sending mechanism that is configured to send the secure envelope and 

5 the second hash to the financial institution; 

6 a decrypting mechanism that is configured to decrypt the secure envelope 

7 using the private key of the financial institution; 

8 a comparing mechanism that is configured to compare the first hash with 

9 the second hash; 

9 



GCW E:\Oracle Corporation\OR01-02701\AmendmentC OR01-02701.doc 



10 wherein the decrypting mechanism is further configured to decrypt the 

1 1 encrypted account number to recover the account number for the account 

1 2 belonging to the consumer; 

13 a first verifying mechanism that is configured to verify that the financial 

14 transaction is valid for the account; and 

1 5 an authorizing mechanism that is configured to authorize the financial 

1 6 transaction. 

1 22. (Original) The apparatus of claim 2 1 , further comprising: 

2 a second verifying mechanism that is configured to verify that the second 

3 certificate was signed by the financial institution; 

4 a determining mechanism that is configured to determine that the account 

5 is valid; and 

6 an ensuring mechanism that is configured to ensure that a transaction 

7 amount is not greater than an authorized transaction amount. 

1 23. (Original) The apparatus of claim 20, wherein the secure site available 

2 only to the consumer is within the smart card. 

1 24. (Cancelled) 
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